looking for wifi router with restricted access to LAN

Question

I need to set up a separate Wifi network for guests, and am looking for a decent router which can be part of the LAN but restrict access so that it can only route to the gateway/WLAN.

Are there any wifi routers which can do this out of the box? I'd rather not use customized WRT-54s, or custom hotspot software, as I do not require logon pages/password generators or any advanced functions, just static setup, but with no access to the LAN!

Answer 1

It is your lan's business to protect itself from your wireless router, not your wireless router's job to protect your lan.

Depending on the size of your site --

hang the AP off of an interface on your firewall

configure an isolated vlan and connect the APs to that vlan, then connect that vlan to your firewall.

Now, configure your firewall to allow that network to access the internet but not the internal network.

Lastly, if you don't want to set that up, go buy yourself a netscreen 5gt-221 with wireless built in. Later, if you decide you need more APs, you can connect those to an interface on the netscreen.

Answer 2

Without knowing more details about your existing LAN, I would suggest looking into VLANs. If your existing infrastructure supports VLANs, you can purchase an Access Point that supports VLANs. Cisco, D-Link, and others have small business APs that support them. You would then configure your switching equipment to route all your wireless guest traffic through a dedicated VLAN and straight out a separate interface in your firewall or router. Configured properly, this would prevent them from ever accessing your local LAN traffic.

Answer 3

Let me preface this with the comment that you SHOULD NOT DO THIS

You can set the subnet of the "outside" interface on any "wireless router" that does nat to be a /30 that includes only your current router/firewall. It goes without saying that you need to make the rules on the firewall not allow traffic from the wireless router into the rest of the /24 production network.

Let's say your current firewall/router's config has 10.10.1.1/24 as the inside interface for your production network. Set your AP's interface to be 10.10.1.2 and it's outside interface netmask to be a /30 (or 255.255.255.252. Now your AP will send all traffic (that isn't in the wireless network) to the firewall. Make sure the wireless router is doing NAT and it isn't acting like a bridge.

So --

router: 10.10.1.1/24 (production network)
AP: 10.10.1.2/30  (outside)
    10.10.2.1/24  (inside)
    10.10.1.1 -> AP's default route

Lastly, if you want to put more APs onto this "wireless network" -- set all the SSIDs to be the same, reduce the power on all the APs, set them to different channels, and turn off DHCP on all but the one connected to the firewall, and then connect the "inside" interface of each new AP to the first AP's "inside" network interfaces.